xxe-phantom

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include attacker-controlled/placeholders and developer-hosted endpoints (ngrok, interactsh, burp collaborator placeholders, YOUR-SERVER URLs), direct references to remote JAR/DTD resources, and GitHub repos for exploitation tools — all are usable as adversary-controlled download/exfiltration hosts and therefore represent high-risk sources for distributing malware or malicious payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an offensive XXE exploitation playbook and tooling that explicitly instructs and implements data exfiltration, credential/cloud-metadata theft, SSRF chaining, and remote code execution techniques (including built-in servers to receive exfiltrated data) — high malicious/abuse intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). EXPOSURE: The runtime workflow in scripts/xxe_probe.py takes outsider-supplied free text parameters --url, --oob, and --file to construct and POST attacker-controlled XML payloads (including external DTD URLs and file paths) to a target endpoint, so the LLM isn’t involved but the outsider free text is ingested by the tool to drive the workflow.